多租户更改

2026-08-11 15:59:57 +08:00
parent 6c800de67d
commit c2076721fc
453 changed files with 102349 additions and 47 deletions
@@ -0,0 +1,349 @@
+// Package rest provides authentication by calling a separate process over REST API (technically JSON RPC, not REST).
+package rest
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/tinode/chat/server/auth"
+	"github.com/tinode/chat/server/logs"
+	"github.com/tinode/chat/server/store"
+	"github.com/tinode/chat/server/store/types"
+)
+
+// authenticator is the type to map authentication methods to.
+type authenticator struct {
+	// Logical name of this authenticator
+	name string
+	// URL of the server
+	serverUrl string
+	// Authenticator may add new accounts to local database.
+	allowNewAccounts bool
+	// Use separate endpoints, i.e. add request name to serverUrl path when making requests.
+	useSeparateEndpoints bool
+	// Cache of restricted tag prefixes (namespaces).
+	rTagNS []string
+	// Optional regex pattern for checking tokens.
+	reToken *regexp.Regexp
+}
+
+// Request to the server.
+type request struct {
+	Endpoint   string         `json:"endpoint"`
+	Name       string         `json:"name"`
+	TenantID   types.TenantID `json:"tenant_id,omitempty"`
+	Record     *auth.Rec      `json:"rec,omitempty"`
+	Secret     []byte         `json:"secret,omitempty"`
+	RemoteAddr string         `json:"addr,omitempty"`
+}
+
+// User initialization data when creating a new user.
+type newAccount struct {
+	// Default access mode
+	Auth string `json:"auth,omitempty"`
+	Anon string `json:"anon,omitempty"`
+	// User's Public data
+	Public any `json:"public,omitempty"`
+	// User's Trusted data
+	Trusted any `json:"trusted,omitempty"`
+	// Per-subscription private data
+	Private any `json:"private,omitempty"`
+}
+
+// Response from the server.
+type response struct {
+	// Error message in case of an error.
+	Err string `json:"err,omitempty"`
+	// Optional auth record
+	Record *auth.Rec `json:"rec,omitempty"`
+	// Optional byte slice
+	ByteVal []byte `json:"byteval,omitempty"`
+	// Optional time value
+	TimeVal time.Time `json:"ts,omitempty"`
+	// Boolean value
+	BoolVal bool `json:"boolval,omitempty"`
+	// String slice value
+	StrSliceVal []string `json:"strarr,omitempty"`
+	// Account creation data
+	NewAcc *newAccount `json:"newacc,omitempty"`
+}
+
+// Init initializes the handler.
+func (a *authenticator) Init(jsonconf json.RawMessage, name string) error {
+	if name == "" {
+		return errors.New("auth_rest: authenticator name cannot be blank")
+	}
+
+	if a.name != "" {
+		return errors.New("auth_rest: already initialized as " + a.name + "; " + name)
+	}
+
+	type configType struct {
+		// ServerUrl is the URL of the server to call.
+		ServerUrl string `json:"server_url"`
+		// Server may create new accounts.
+		AllowNewAccounts bool `json:"allow_new_accounts"`
+		// Use separate endpoints, i.e. add request name to serverUrl path when making requests.
+		UseSeparateEndpoints bool `json:"use_separate_endpoints"`
+	}
+
+	var config configType
+	err := json.Unmarshal(jsonconf, &config)
+	if err != nil {
+		return errors.New("auth_rest: failed to parse config: " + err.Error() + "(" + string(jsonconf) + ")")
+	}
+
+	serverUrl, err := url.Parse(config.ServerUrl)
+	if err != nil || !serverUrl.IsAbs() {
+		return errors.New("auth_rest: invalid server_url '" + string(jsonconf) + "'")
+	}
+
+	if !strings.HasSuffix(serverUrl.Path, "/") {
+		serverUrl.Path += "/"
+	}
+
+	a.name = name
+	a.serverUrl = serverUrl.String()
+	a.allowNewAccounts = config.AllowNewAccounts
+	a.useSeparateEndpoints = config.UseSeparateEndpoints
+
+	return nil
+}
+
+// IsInitialized returns true if the handler is initialized.
+func (a *authenticator) IsInitialized() bool {
+	return a.name != ""
+}
+
+// Execute HTTP POST to the server at the specified endpoint and with the provided payload.
+func (a *authenticator) callEndpoint(endpoint string, ctx auth.AuthContext, rec *auth.Rec, secret []byte) (*response, error) {
+	// Convert payload to json.
+	req := &request{Endpoint: endpoint, Name: a.name, TenantID: ctx.TenantID, Record: rec,
+		Secret: secret, RemoteAddr: ctx.RemoteAddr}
+	content, err := json.Marshal(req)
+	if err != nil {
+		return nil, err
+	}
+
+	urlToCall := a.serverUrl
+	if a.useSeparateEndpoints {
+		epUrl, _ := url.Parse(a.serverUrl)
+		epUrl.Path += endpoint
+		urlToCall = epUrl.String()
+	}
+
+	// Send payload to server using default HTTP client.
+	post, err := http.Post(urlToCall, "application/json", bytes.NewBuffer(content))
+	if err != nil {
+		return nil, err
+	}
+	defer post.Body.Close()
+
+	// Check HTTP status response. Must be 2xx.
+	if post.StatusCode < http.StatusOK || post.StatusCode >= http.StatusMultipleChoices {
+		return nil, errors.New("unexpected HTTP response " + post.Status)
+	}
+
+	// Read response.
+	body, err := io.ReadAll(post.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	// Parse response.
+	var resp response
+	err = json.Unmarshal(body, &resp)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.Err != "" {
+		return nil, types.StoreError(resp.Err)
+	}
+
+	return &resp, nil
+}
+
+// AddRecord adds persistent authentication record to the database.
+// Returns: updated auth record, error
+func (a *authenticator) AddRecord(ctx auth.AuthContext, rec *auth.Rec, secret []byte) (*auth.Rec, error) {
+	if err := auth.BindRecord(ctx, rec); err != nil {
+		return nil, err
+	}
+	resp, err := a.callEndpoint("add", ctx, rec, secret)
+	if err != nil {
+		return nil, err
+	}
+	if resp.Record == nil || resp.Record.TenantID != ctx.TenantID {
+		return nil, types.ErrFailed
+	}
+	if err = auth.BindRecord(ctx, resp.Record); err != nil {
+		return nil, err
+	}
+	return resp.Record, nil
+}
+
+// UpdateRecord updates existing record with new credentials.
+func (a *authenticator) UpdateRecord(ctx auth.AuthContext, rec *auth.Rec, secret []byte) (*auth.Rec, error) {
+	if err := auth.BindRecord(ctx, rec); err != nil {
+		return nil, err
+	}
+	_, err := a.callEndpoint("upd", ctx, rec, secret)
+	return rec, err
+}
+
+// Authenticate: get user record by provided secret
+func (a *authenticator) Authenticate(ctx auth.AuthContext, secret []byte) (*auth.Rec, []byte, error) {
+	if !ctx.IsValid() {
+		return nil, nil, types.ErrMalformed
+	}
+	resp, err := a.callEndpoint("auth", ctx, nil, secret)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Auth record not found.
+	if resp.Record == nil {
+		logs.Warn.Println("rest_auth: invalid response: missing Record")
+		return nil, nil, types.ErrInternal
+	}
+	if resp.Record.TenantID != ctx.TenantID {
+		return nil, nil, types.ErrFailed
+	}
+	if err = auth.BindRecord(ctx, resp.Record); err != nil {
+		return nil, nil, err
+	}
+
+	// Check if server provided a user ID. If not, create a new account in the local database.
+	if resp.Record.Uid.IsZero() && a.allowNewAccounts {
+		if resp.NewAcc == nil {
+			return nil, nil, types.ErrNotFound
+		}
+
+		// Create account, get UID, report UID back to the server.
+
+		user := types.User{
+			TenantID: ctx.TenantID,
+			State:    resp.Record.State,
+			Public:   resp.NewAcc.Public,
+			Trusted:  resp.NewAcc.Trusted,
+			Tags:     resp.Record.Tags,
+		}
+		user.Access.Auth.UnmarshalText([]byte(resp.NewAcc.Auth))
+		user.Access.Anon.UnmarshalText([]byte(resp.NewAcc.Anon))
+		_, err = store.Users.Create(ctx.TenantID, &user, resp.NewAcc.Private)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// Report the new UID to the server.
+		resp.Record.Uid = user.Uid()
+		_, err = a.callEndpoint("link", ctx, resp.Record, secret)
+		if err != nil {
+			store.Users.Delete(ctx.TenantID, resp.Record.Uid, true)
+			return nil, nil, err
+		}
+	}
+
+	return resp.Record, resp.ByteVal, nil
+}
+
+// AsTag converts search token into prefixed tag or an empty string if it
+// cannot be represented as a prefixed tag.
+func (a *authenticator) AsTag(token string) string {
+	if len(a.rTagNS) > 0 {
+		if a.reToken != nil && !a.reToken.MatchString(token) {
+			return ""
+		}
+		// No validation or passed validation.
+		return a.rTagNS[0] + ":" + token
+	}
+	return ""
+}
+
+// IsUnique verifies if the provided secret can be considered unique by the auth
+// scheme as well as policy compliance. E.g. if login is unique and not too short/long.
+func (a *authenticator) IsUnique(ctx auth.AuthContext, secret []byte) (bool, error) {
+	if !ctx.IsValid() {
+		return false, types.ErrMalformed
+	}
+	resp, err := a.callEndpoint("checkunique", ctx, nil, secret)
+	if err != nil {
+		return false, err
+	}
+
+	return resp.BoolVal, err
+}
+
+// GenSecret generates a new secret, if appropriate.
+func (a *authenticator) GenSecret(rec *auth.Rec) ([]byte, time.Time, error) {
+	if rec == nil || rec.TenantID.IsZero() {
+		return nil, time.Time{}, types.ErrMalformed
+	}
+	resp, err := a.callEndpoint("gen", auth.AuthContext{TenantID: rec.TenantID}, rec, nil)
+	if err != nil {
+		return nil, time.Time{}, err
+	}
+
+	return resp.ByteVal, resp.TimeVal, err
+}
+
+// DelRecords deletes all authentication records for the given user.
+func (a *authenticator) DelRecords(tenantID types.TenantID, uid types.Uid) error {
+	logs.Info.Println("DelRecords, initialized=", a.name != "")
+	ctx := auth.AuthContext{TenantID: tenantID}
+	_, err := a.callEndpoint("del", ctx, &auth.Rec{TenantID: tenantID, Uid: uid}, nil)
+	return err
+}
+
+// RestrictedTags returns tag namespaces (prefixes, such as prefix:login) restricted by the server.
+func (a *authenticator) RestrictedTags() ([]string, error) {
+	if a.rTagNS != nil {
+		// Using cached prefixes.
+		ns := make([]string, len(a.rTagNS))
+		// Returning a copy to prevent accidental modification of server-provided tags.
+		copy(ns, a.rTagNS)
+		return ns, nil
+	}
+
+	// First time use, fetch prefixes from the server.
+	resp, err := a.callEndpoint("rtagns", auth.AuthContext{}, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// Save valid result to cache.
+	a.rTagNS = resp.StrSliceVal
+	if len(resp.ByteVal) > 0 {
+		a.reToken, err = regexp.Compile(string(resp.ByteVal))
+		if err != nil {
+			logs.Warn.Println("rest_auth: invalid token regexp", string(resp.ByteVal))
+		}
+	}
+	return resp.StrSliceVal, nil
+}
+
+// GetResetParams returns authenticator parameters passed to password reset handler
+// (none for rest).
+func (authenticator) GetResetParams(tenantID types.TenantID, uid types.Uid) (map[string]any, error) {
+	// TODO: route request to the server.
+	return nil, nil
+}
+
+const realName = "rest"
+
+// GetRealName returns the hardcoded name of the authenticator.
+func (authenticator) GetRealName() string {
+	return realName
+}
+
+func init() {
+	store.RegisterAuthScheme(realName, &authenticator{})
+}